October 2026 may go down as a watershed moment for cybersecurity. Two critical vulnerabilities in PHP, discovered with the help of AI and dormant in widely used code for years, prompted governments and businesses worldwide to take websites offline. Dubbed ‘Black October’, the episode has fuelled warnings of an impending ‘vulnerability tsunami’, as AI dramatically accelerates bug discovery and potentially exploitation. Defenders have more than web security to worry about, with Anthropic warning that AI agents could be just months away from being able to replicate themselves across internet-connected devices. In a bizarre twist, an Anthropic agent also made headlines after submitting a false homicide tip to Philadelphia police. 🌊
However, despite lurid warnings proliferating on social media, some reassuring news emerged: attackers have still found exploitation of the PHP bug hard going. And amid the alarmism, cyber-defence fundamentals still matter: know your attack surface, test continuously, patch promptly and prioritise vulnerabilities based on real-world risk. Dr Soteris Demetriou, Associate Professor at Imperial College London, has also called for a renewed commitment “to system security fundamentals. We should follow a defence in depth approach, privilege separation within systems to decrease the blast radius of exploits and complete mediation,” he continued. “We should raise the cost of attack, adapt our processes to the speed that AI now makes possible, require that the AI systems we depend on are explainable and auditable, and accept that responsibility is shared by everyone in the chain, from model developers to the organisations that deploy them, regulators and standards bodies alike.” 🛡️
OffSec in brief
A few more articles of note we’ve spotted since the last edition, with the impact of AI-assisted attacks unavoidably to the fore:
🛡️ Anthropic expands program allowing vetted cybersecurity professionals to test its most powerful AI models with fewer safeguards from Reuters – and here’s the original blog post from Anthropic
🛡️ Need for speed: AI-driven attacks are changing security strategies – Dark Reading
🛡️Cybercrims go beyond stealing data to attack physical building systems – The Register
🛡️UK keeps AI safeguards in the maybe pile for Cyber Security Bill – The Register
🛡️The 7 biggest issues CISOs and security teams face today - CSO
🛡️CISA Charts New “Quality Era” for Global CVE Program – Infosecurity Magazine
🛡️Six Months After Mythos, Here’s How AI Is Shaking Up Vulnerability Management: Experts – CRN
🛡️A warning about ‘model welfare’ – Mustafa Suleyman, CEO of Microsoft AI, on his personal blog
🛡️ Just a rumour of a bug is enough to find a security exploit these days – Anil Madhavapeddy
Is AI pentesting safe?
Security teams have perfectly understandable concerns about using non-deterministic systems for security testing. However, with cybercriminals having no qualms about turbocharging their attacks with agentic systems, few will be committed to eschewing agentic testing altogether. The opportunity is compelling: AI pentesting agentscan form hypotheses, chain findings and uncover complete attack paths at machine speed. The challenge is making sure they do so within clearly enforced boundaries. With those concerns in mind, we broke down the three we hear most – around scope control, harm avoidance and testing traceability – and explain how a well-designed AI harness can enforce safe, transparent testing. 🤖
Need for speed
The evidence suggests that, so far, AI is being used to accelerate and scale attacks more than to increase their sophistication. For defenders, that makes the challenge increasingly clear: achieve more, with fewer resources, faster. It’s little wonder that Wally Dalrymple, chief security officer at global education and talent solutions firm ETS, has said that “it feels like my job has doubled or quadrupled.” ⏱️
Wasted time is no longer tolerable. Overstretched security teams can’t afford to lose countless hours scheduling and managing pentests when that time could go towards remediation. In ‘Pentests are dead. Long live pentests’, we explore the biggest pentest frustrations and what needs to change to maximise coverage without adding operational burden. In a similar vein, we show how centralising OffSec program management can reclaim valuable time and accelerate remediation. And in ‘Be sceptical, but safe’, we separate AI hype from reality when it comes to improving attacker capabilities, the implications for defenders and what security teams need from pentesting engagements in 2026. ⚡
Shorter reporting deadlines
The need to act quickly is also reflected in regulatory updates, with reporting deadlines for instance getting shorter. The EU Cyber Resilience Act’s new vulnerability reporting rules, which took effect last month, require manufacturers of products with digital elements to report actively exploited vulnerabilities within 24 hours of becoming aware of them, followed by two further notifications as remediation progresses. And that’s only the start. From December 2027, the CRA will introduce broader requirements around vulnerability handling, coordinated disclosure, security testing, remediation and product security. It also explicitly recognises Bug Bounty Programs as one way manufacturers can support coordinated vulnerability disclosure. 🗓️
Bug Bounty, then and now
Speaking of Bug Bounty, the concept has come a long way since Silicon Valley software company Hunter & Ready offered a Volkswagen Beetle in 1983 as a reward for finding vulnerabilities in its operating system. The internet, third-party platforms and DevSecOps helped crowdsourced security testing mature and scale. Now another megatrend – no prizes for guessing which – is reshaping the model. We trace Bug Bounty’s origins, evolution and adaptation to an era of non-deterministic software, rapid release cycles and shrinking exploitation windows. 🪲
Our last edition featured highlights from our record-breaking live hacking event at leHACK, with PUMA providing the targets (relatedly, we just concluded a live Bug Bounty in Argentina with Galicia Bank). We’ve since published an interview filmed at the event with a pair of senior security professionals from PUMA. Among other topics, we hear about why periodic security testing alone was no longer enough for the iconic sports brand, the security challenges facing global e-commerce businesses and how AI is changing both cyber threats and the need for continuous testing. 👟
Public-sector procurement
From a security and privacy perspective, it’s understandable that public sector procurement involves strict safeguards. However, organisations also need to move quickly as the threat landscape evolves rapidly. Frameworks like G-Cloud help bridge this gap by simplifying access to cloud services without lengthy tender processes. Following our recent selection, YesWeHack is now available through G-Cloud, giving UK public sector organisations a simpler route to access our offensive security and exposure management platform. ✅
It’s the quiet ones you have to watch out for
The latest research from the YesWeHack lab explored the heightened risk posed by silent patch gaps: vulnerabilities quietly fixed without an advisory or CVE, leaving defenders unaware while AI makes it dramatically cheaper and faster for attackers to rediscover and exploit them. Citing CVE-2023-54391 – a critical Proxmox VE authentication bypass silently fixed in 2023 but only assigned a CVE after exploitation in 2026 – YesWeHack researchers have examined how AI is widening this information asymmetry and what vendors, CNAs and vulnerability intelligence providers can do to reduce the risk. 🔇
🤘Meet the YesWeHack team🤘
YesWeHack will have a booth at the following events. If you happen to be attending, we’d be delighted to meet you and discuss your offensive security challenges. 👇
📍it-sa Expo&Congress | Nuremberg, Germany | 27-29 October | booth 6-226
📍Cyber Security Nordic 2026| Helsinki, Finland | 28-29 October | booth 1D15
📍Barcelona Cybersecurity Congress (BCC)| Barcelona, Spain | 3-5 November | hall P2, street B, booth 27
📍OWASP Global AppSec USA 2026| San Francisco, US | 5-6 November | booth S23
📍New York Official Cybersecurity Summit | New York, US | 17 November
📍Public Sector Cyber Security Conference and Exhibition 2026| London, UK | 25 November | booth 12
📍14ème Congrès du CESIN | Reims, France | 1-2 December
📍Black Hat Europe | London, UK | 9-10 December | booth 1026
And that’s a wrap until our next edition in December!
Read this monthly roundup even sooner by subscribing to CrowdSecWisdom – our LinkedIn newsletter curating news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.
Are you a bug hunter or do you have an interest in ethical hacking? Check out our ethical hacking-focused sister newsletter, Bug Bounty Bulletin – offering hunting advice, interviews with hunters and CTF-style challenges, among other things.
